Outlook在中国遭中间人攻击

网络监测组织GreatFire于1月17日收到了报告,指微软电邮系统outlook在中国遭中间人攻击(MITM)。此次攻击针对通过移动设备上的邮件客户端收发outlook邮件的人士。该组织怀疑,此次攻击是审查部门在测试防火墙技术。

当中国用户通过电子邮件客户端(Ice-dove)进入outlook时,可看到以下证书:

Greatfire的测试证实了outlook确实遭到攻击:IMAP(交互邮件访问协议)与SMTP(简单邮件传输协议)都遭受了中间人攻击。但网站界面(https://outlook.com 和 https://login.live.com/)没有受到影响。这次攻击持续了大约一天,现在已经停止。

这种形式的攻击尤其狡猾:相比于通过浏览器,用户通过电子邮件客户端所接收到的警告非常不明显,更容易被忽略。如下图:

(从iphone默认电邮客户端接收到的错误样本)

当客户端试图自动检索信息时,用户只能看见一个突然弹出的警告。因为用户没有主动检索信息,大多数的用户在点击“继续”之前不会细想,却忽视了警告信息、或把警告信息归咎于网络连线的故障。如果用户真的点击了“继续”,他(她)所有的邮件、通讯录、密码都会被黑客所窃取。

这次黑客攻击发生在Gmail被封锁之后的一个月之内(Gmail到现在仍然处于完全无法使用状态)。由于这次中间人攻击与之前对谷歌、苹果、雅虎等的攻击存在诸多相似之处,Greatfire再次怀疑,中国国家互联网信息办公室精心策划了这次袭击,或者有意允许袭击发生。这就意味着中国当局有意进一步打击他们无法容易监控的通信手段

至截稿为止,微软公司尚未对此事作出回应。

三个月前,针对苹果iCloud储存服务的中间人攻击促使苹果总裁库克亲自到中国与当局交涉。中国外交部新闻发言人随后否认了攻击,苹果也从未公开与中方的交涉结果。苹果后来创建了一个“中文帮助页面”来处理相似的问题,并将其称为“有组织的网络攻击”(organized network attacks)。

在苹果被攻击的同时,谷歌和雅虎也有经历类似的中间人攻击,微软outlook的网页版也曾在短时间内受攻击。当局似乎是在测试他们的中间人攻击技术,并搜集用户反应。通过追踪有多少用户忽视了警告信息,当局可以评估这类攻击的有效性。

GreatFire强烈建议用户,千万不要绕过证书提示的“错误信息”去点击“继续”

 

呼吁停止信任CNNIC证书

GreatFire怀疑国家网信办对此次黑客攻击outlook、以及其他几起类似的攻击负有直接责任。由于中国互联网信息中心(CNNIC)的直接主管部门是国家网信办,它所认证的安全证书也因此不值得信任。

GreatFire再次呼吁互联网公司和相关组织,包括微软和苹果,立即停止将CNNIC作为认证机构(certification authority)的信任

- CNNIC的证书有什么作用?

它可以用于初步地识别个人或设备的身份、鉴定服务、加密文件。

什么是认证机构(certification authority: CA)?

认证机构是颁发证书的机构。他们建立和验证了公共密钥的鉴定系统,以及核实请求密钥的个人或组织的身份。

 

Technical Details

IMAP/SMTP are commonly used on mobile email clients (e.g the default mail application on iPhones) and desktop email clients like Thunderbird. Internet Message Access Protocol (IMAP) is a protocol which allows users to connect to the same mailbox through multiple devices (i.e. your desktop, mobile, etc.). Simple Mail Transfer Protocol (SMTP) is typically used by users to send messages to a server which are then relayed to the recipient.

Wikipedia defines a man-in-the-middle (MITM) attack in the following way:

The man-in-the-middle attack...is a form of active eavesdropping in which the attacker makes independent connections with the victims and relays messages between them, making them believe that they are talking directly to each other over a private connection, when in fact the entire conversation is controlled by the attacker.

测试

为了在火狐浏览器中复制以上结果,我们首先在火狐中设置允许接入端口993,这也是IMAP所使用的端口。然后,我们登入https://imap-mail.outlook.com:993,立刻收到了警告信息。正如你在下图所看到的那样,这份证书是自我签名的(self-signed)。

  outlook-MITM.png

下图可以看到Chrome中显示的证书错误。Chrome也被设置成允许通过端口993进行连接。

The fake certificate used in the attack:

https://github.com/chengr28/RevokeChinaCerts/blob/master/Windows/Certs/[Fake]AnyHotmailCom_201501.crt

WireCapture:

https://www.cloudshark.org/captures/8bf76336e67d

Reports:

https://www.v2ex.com/t/163062 and https://www.v2ex.com/t/163018.

 

评论

更多博客文章

订阅 email
显示 博客 | Google+ | Twitter | 全部 的消息. 使用 RSS 订阅我们的博客。

星期一, 6月 10, 2019

苹果审查中国西藏的信息

苹果在涉及西藏的审查方面有着悠久历史。 2009年,据计算机世界网透露 ,与达赖喇嘛有关的几个应用程序在苹果的中国区应用商店中不存在。这些应用的开发者未收到他们的应用被删除的通知。当面对这些审查制度时,苹果发言人只是说该公司将“继续遵守当地法律”。

2017年12月,在中国的一次会议上,当被问及与中国当局合作审查苹果应用商店时,蒂姆·库克 宣称

“所以你的选择是参与进去,还是站在局外,吼叫着事情应当怎样?我自己的看法非常强烈,你得进入赛场,因为没有任何东西会从局外发生改变。"

自苹果公司首次因与中国当局合作以遏制已被边缘化的声音而被批评的十年间,情况发生了什么变化?苹果继续严格遵守中国当局的审查令。蒂姆库克什么时候会期望他的公司能帮助在中国带来积极的变化?

根据生成的数据 https://applecensorship.com,Apple现在已经审查了在中国应用商店中29个西藏的热门应用程序。关于新闻,宗教研究,旅游甚至游戏的西藏主题应用程序正在被苹果审查。最下方附有完整的审查应用列表。

“苹果的领导力隐藏在他们审查应用程序以遵守模糊的'中国当地法律'的借口,但他们的行为缺乏任何透明度。通过从中国苹果应用商店删除藏文和其他许多应用程序,苹果阻碍了藏人获取信息和自由表达自己的能力,这是国际法下的一项基本人权。“ TibCERT(西藏计算机应急准备小组)的响应协调员Dorjee Phuntsok说道。 他们与GreatFire合作对被屏蔽的应用程序进行了分析。

   2019年1月,GreatFire推出了applecensorship.com。在那时,GreatFire联合创始人马丁约翰逊指出:“苹果公司在其透明度报告中没有分享有关应用商店审查的信息 - 该项目强制透明度。蒂姆库克可以随心所欲地说苹果在中国做了或没有做什么,但 applecensorship.com 提供了可以实际看到苹果实施审查原始数据的途径。

分析苹果在中国审查的iOS应用程序

有许多应用程序由藏人或为藏人制作,苹果正在审查中国区应用商店中的许多应用程序。了解某些应用程序被阻止的方式和原因以及这些决策背后的基本原理非常重要。为了解这一点,TibCERT(西藏应急准备小组)对在中国应用商店中被审查的藏文应用程序进行了分析。该研究使用关键字搜索藏文应用程序,然后使用GreatFire提供的应用程序审查平台。

TibCERT分析了119个以藏语为主题的iOS应用程序。使用“西藏”,“藏人”,“达赖喇嘛”,“佛教”,“藏传佛教”,等关键词搜索苹果应用商店时,可以找到下面列出的应用程序。这些应用程序分为五大类:“宗教或文化”,“媒体/政治”,“娱乐”,“工具”和“教育”。

星期四, 6月 06, 2019

重点关注苹果在中国审查实践的报告

最新的 数字版权企业责任指数排名 就公司和政府需要做些什么来提出建议,以改善全球互联网用户的人权保护。数字版权排名(RDR)旨在通过为公司尊重和保护用户权利制定全球标准和激励措施,以促进互联网上的言论自由和隐私权。

在他们的2019年责任指数中,RDR着眼于24家世界上最重要的互联网公司在言论自由和隐私方面的政策,并强调了那些尚需努力和已经取得改进的公司。 RDR指出:

透明度不足使私人政党,政府和公司本身更容易通过网络言论滥用权力,并规避责任。

特别是,该报告强调了苹果如何滥用其网络言论的权力,并在中国指出这一点。根据该报告,苹果公司在面对政府当局提出的要求时,并未披露其从App Store中删除内容的数据。

虽然[苹果]披露了有关政府限制帐户请求的数据,但它没有披露有关内容删除请求的数据,例如从苹果应用商店删除应用程序的请求。苹果公司对其影响言论自由的政策和做法讳莫如深,这让它的排名低于此类别的所有其他美国公司。

该报告为政府提出了明智而感性的建议。然而,这些建议还强调了与中国政府进行这些讨论是多么的困难。

RDR 建议政府要求公司的透明度并保持透明度。中国当局采取相反的做法 - 他们不希望在这些问题上保持透明度,因为它突显了他们不希望公众了解的信息。当局不希望公司透明,他们可能直接指示Apple不发布他们正删除的内容列表。

苹果可能真的认为他们必须遵守中国的法律条文。或者他们也可能愿意分享有关App Store中被审查内容的信息,但有碍于被中国当局束手束脚。苹果还可能会利用这种情况作为他们打击中国言论自由的掩护。无论Apple的真实动机如何,透明度都能够并已经被强加给他们。

在2019年1月,GreatFire发布了 applecensorship.com。该项目监控Apple在公司运营的每个市场中对App Store的审查。应用程序的可用性测试由网站访问者进行。截至今天,用户生成的测试已经确定了 超过1100个 在中国应用商店中不可用的应用。在中国受审查的应用程序包括那些涉及宗教,新闻,隐私和翻墙的应用程序。通过审查有助于规避审查限制的应用程序,苹果确实的让中国人无法自由访问信息。苹果的中国用户或许认为他们买到的是一流的设备 - 但可以肯定的是,该公司将他们视为二等信息公民。

RDR建议苹果对言论自由的限制保持透明,并公布有关公司因政府要求而删除内容所采取行动的数据。我们邀苹果审核我们在 applecensorship.com 上公开发布的数据,并根据中国当局的指示突出显示已删除应用的情况。

星期四, 11月 30, 2017

关于在中国苹果商店被审查的那674个软件

苹果对中国区的审查行为敞开了大门 - 但这似乎只是冰山一角。

星期二, 5月 23, 2017

Is China establishing cyber sovereignty in the United States?

Last week Twitter came under attack from a DDoS attack orchestrated by the Chinese authorities. While such attacks are not uncommon for websites like Twitter, this one proved unusual. While the Chinese authorities use the Great Firewall to block harmful content from reaching its citizens, it now uses DDoS attacks to take down content that appears on websites beyond its borders. For the Chinese authorities, it is not simply good enough to “protect” the interests of Chinese citizens at home - in their view of cyber sovereignty, any content that might harm China’s interests must be removed, regardless of where the website is located.

And so last week the Chinese authorities determined that Twitter was the target. In particular, the authorities targeted the Twitter account for Guo Wengui (https://twitter.com/KwokMiles), the rebel billionaire who is slowly leaking information about corrupt Chinese government officials via his Twitter account and through his YouTube videos. Guo appeared to ramp up his whistle-blowing efforts last week and the Chinese authorities, in turn, ramped up theirs.

via https://twitter.com/KwokMiles/status/863689935798374401

星期一, 12月 12, 2016

China is the obstacle to Google’s plan to end internet censorship

It’s been three years since Eric Schmidt proclaimed that Google would chart a course to ending online censorship within ten years. Now is a great time to check on Google’s progress, reassess the landscape, benchmark Google’s efforts against others who share the same goal, postulate on the China strategy and offer suggestions on how they might effectively move forward.

flowers on google china plaque

Flowers left outside Google China’s headquarters after its announcement it might leave the country in 2010. Photo: Wikicommons.

What has Google accomplished since November 2013?

The first thing they have accomplished is an entire rebranding of both Google (now Alphabet) and Google Ideas (now Jigsaw). Throughout this blog post, reference is made to both new and old company names.

Google has started to develop two main tools which they believe can help in the fight against censorship. Jigsaw’s DDoS protection service, Project Shield, is effectively preventing censorship-inspired DDoS attacks and recently helped to repel an attack on Brian Krebs’ blog. The service is similar to other anti-DDoS services developed by internet freedom champions and for-profit services like Cloudflare.

使用 RSS 订阅我们的博客。

评论

Removing CNNIC root isn't practical, as it prevents the company from selling devices in China. Please make more practical recommendations. For example, only accept CNNIC-signed certificates for .CN domains. That would allow CNNIC to continue to exercise control over Chinese domains without jeopardizing the security of the entire Internet. (This is basically "TLD pinning" for root CAs.)

 Romantic Getaways: You can also plan a romantic holiday with
your loved one. It is really nice to see all these valentine's
day gift ideas for dogs, cause you two will be hollering with
love don't you know. This need not always be romantic love but any love.

Review my site: Propose Day SMS

After Daytona Beach Police Detectives finished their investigation of the incident, the scene was turned over to a site manager for Clean
Fuels National, who police emphasized was not at the
scene when the incident happened. It has emerged as one of the
best weekend destinations especially for families.
The last four or five years there's been more of a mix of INDYCAR drivers going over, which
is good for both series.

Also visit my web site ... daytona 500 live streaming

this post is awesome, great msg for us, plz update ur blog for daily basis, i am regular visitor of this site, so keep posting for us,

click the below links to create backlink
best free backlink website
click here for msg movie

thanks for this post, keep it up for updating us, i am waiting for ur new article.

thanks again
IPL8 live stream 2015

It’s certainly fresh to writing and seeing concepts which are truly helpful to get the direction

mothers day quotes
happy mothers day qutes 2015
happy mothers day 2015

Nice post to share
http://listacademyanik.com/

Nice post to share.
CLICK HERE>>
http://www.100kfactoryultraeditionreview.com/

----------------------------------------
There many errors that can hurt your PPC project without you even understanding it. For this factor, I wish to present to you the leading 5 factors your Pay Per Click project suffers online. look at part 1 of this article
----------------------------------------
CHECKOUT>>www.100kfactoryultraeditionreview.com

--------------------------------------------------------------------------------
http://listacademyanik.com/
============================================

Hey,

"Good website! I really love how it is easy on my eyes and the data are well written. I am wondering how I could be notified when a new post has been made. I have subscribed to your RSS feed which must do the trick! Have a nice day!"

======================
CLICK HERE>>http://listacademyanik.com/

======================

Hey ,
I would like to thank you for the efforts you have put in writing this website. I'm hoping the same high-grade web site post from you in the upcoming also. In fact your creative writing abilities has inspired me to get my own web site now. Actually the blogging is spreading its wings rapidly.

http://listacademyanik.com/dna-wealth-blueprint-3-0-review-bonus

good Study how to setup Kodi earlier known as noted as XBMC Kodi Download Linux, iOS, Windows, and Android. Moreover, Kodi App Android nice.

good The formal webpage of Droid4x packages a tiny method data file on Droid4x your laptop when you struck the ‘download&' button. nice.

good cannot send or receive messages or pictures utilizing it. snapchat sign in file from its web site and also run the installer as well as nice.

Download caller name announcer from callernameannouncer.uniqsofts.com to read al incoming notifications.

Thanks mate for share this nice post
obat pembesar penis klg: http://obatfrigid.com/obat-klg.html

Playstore in our android devices since long. Though Playstore is fairly aptoide apk you uninstall the app, simply click the apk once again and install

Game Guardian is an amazing game hack/alteration tool. Game guardian helps you modify money, HP, Sp and more aspects of the game.
game guardian apk

I definitely enjoyed every bit of it and I have you bookmarked to see new information on your blog.
my boy

A festival is an event ordinarily celebrated by a community and centering on some characteristic aspect of that community and its religion or traditions. It is often marked as a local or national holiday, mela, or eid.

http://festival-status.wallinside.com

For a lot of us looking to establish an online store, 'e-commerce' is where it all begins. When you find this phrase in articles and testimonials - it simply refers to the buying and selling of products on the internet.
To Get More Info>> https://www.7figurecyclereviewbonus.com/ << VISIT HERE

After reading the article I updated my knowledge regarding the same.
It really helped me a lot.
Thanks for sharing this with us.

https://www.kickstarter.com/profile/netgearsupport/about

At this rate, shouldn't China create their own operating system like what North Korea did? Everything is banned, it's so annoying for tourists. Thank you for sharing the news! I want to visit China some day but with this policy, I can't receive email from work when traveling, it's very hard for me.
https://htmlcolor-codes.com/

添加新评论

Filtered HTML

  • 自动将网址与电子邮件地址转变为链接。
  • 允许的HTML标签:<a> <em> <strong> <cite> <blockquote> <code> <ul> <ol> <li> <dl> <dt> <dd>
  • 自动断行和分段。

Plain text

  • 不允许HTML标记。
  • 自动将网址与电子邮件地址转变为链接。
  • 自动断行和分段。
By submitting this form, you accept the Mollom privacy policy.